Skip to content
Request an audit

‹ Findings database

ERC20AssetPool and ERC721AssetPool should have the nonReentrant modifier as ERC721 and some tokens have callbacks

Low/InfoSingularity audit·Three Sigma·Private DeFi access·26th February, 20243S-SG-L06

Description

ERC721 implements a callback when transferring tokens. Some tokens, such as ERC777 implement callbacks when transferring. Both these tokens could lead to reentrancy.

Recommendation

Implement the nonReentrant modifier for ERC20AssetPool and ERC721AssetPool.

Status

Addressed in #8b300f0.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests